chmod /home directories to 0700

This is based on https://github.com/dev-sec/ansible-collection-hardening/pull/277
and updated to work with the new collection.

Thanks to @aardbol for this initial implementation!

Signed-off-by: Sebastian Gumprich <[email protected]>

roles/os_hardening/defaults/main.yml

@@ -13,8 +13,14 @@ os_auth_pam_pwquality_options: 'try_first_pass retry=3 type='  # used in RHEL7
 os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
 
 os_chfn_restrict: ''
+
+# Set to false to disable chmod /home folders to 700
+os_chmod_home_folders: true
+
 # may contain: change_user
 os_security_users_allow: []
+# specify user home folders in /home that shouldn't be chmodded to 700
+os_ignore_home_folder_users: ['lost+found']
 # specify system accounts those login should not be disabled and password not changed
 os_ignore_users: ['vagrant', 'kitchen']
 os_security_kernel_enable_module_loading: true